2016 CVEs (page 18)
Page 18 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-4858 | Medium | 4.8 | 2017-05-12 | Cross-site scripting vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10… |
CVE-2016-4857 | Medium | 6.1 | 2017-05-12 | Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.2, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.11 and Splu… |
CVE-2016-4856 | Medium | 4.8 | 2017-05-12 | Cross-site scripting vulnerability in Splunk Enterprise 6.3.x prior to 6.3.5 and Splunk Light 6.3.x prior to 6.3.5 allows attacker with administrator rights to… |
CVE-2016-4855 | Medium | 6.1 | 2017-05-12 | Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2016-4839 | Medium | 5.5 | 2017-05-12 | The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Fo… |
CVE-2016-4838 | High | 7.8 | 2017-05-12 | The Android Apps Money Forward (prior to v7.18.0), Money Forward for The Gunma Bank (prior to v1.2.0), Money Forward for SHIGA BANK (prior to v1.2.0), Money Fo… |
CVE-2016-10296 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm shared memory driver could enable a local malicious application to access data outside of its permissio… |
CVE-2016-10295 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm LED driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2016-10294 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm power driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2016-10293 | Medium | 4.7 | 2017-05-12 | An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels… |
CVE-2016-10292 | Medium | 5.5 | 2017-05-12 | A denial of service vulnerability in the Qualcomm Wi-Fi driver could enable a proximate attacker to cause a denial of service in the Wi-Fi subsystem. This issu… |
CVE-2016-10291 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm Slimbus driver could enable a local malicious application to execute arbitrary code within the context… |
CVE-2016-10290 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm shared memory driver could enable a local malicious application to execute arbitrary code within the co… |
CVE-2016-10289 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm crypto driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2016-10288 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm LED driver could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2016-10287 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-10286 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-10285 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-10284 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-10283 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-10282 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code within the context… |
CVE-2016-10281 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code within the context… |
CVE-2016-10280 | High | 7.0 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code within the context… |
CVE-2016-10277 | High | 7.8 | 2017-05-12 | An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2016-10276 | High | 7.8 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2016-10275 | High | 7.8 | 2017-05-12 | An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of t… |
CVE-2016-10274 | High | 7.8 | 2017-05-12 | An elevation of privilege vulnerability in the MediaTek touchscreen driver could enable a local malicious application to execute arbitrary code within the cont… |
CVE-2016-10370 | High | 7.5 | 2017-05-11 | An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow f… |
CVE-2016-7476 | High | 7.5 | 2017-05-11 | The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11.6.0 HF6, 11.5.0 bef… |
CVE-2016-9100 | High | 7.8 | 2017-05-11 | Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.13, ASG 6.7 prior to 6.7.3.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6 prior to 6.6.5.13, and Proxy… |
CVE-2016-9099 | Medium | 6.1 | 2017-05-11 | Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6.7.2.1 are suscepti… |
CVE-2016-9097 | High | 7.2 | 2017-05-11 | The Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 prior to 6.7.1.2 man… |
CVE-2016-9092 | High | 8.8 | 2017-05-11 | The Symantec Content Analysis (CA) 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense (MTD) 1.1 management consoles are susceptible to a cross-site request for… |
CVE-2016-2126 | Medium | 6.5 | 2017-05-11 | Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote… |
CVE-2016-9250 | High | 7.5 | 2017-05-10 | In F5 BIG-IP 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able to delete arbitrary… |
CVE-2016-6037 | Medium | 4.8 | 2017-05-10 | IBM Rational Team Concert (RTC) is vulnerable to HTML injection. A remote attacker with project administrator privileges could send a project that contains mal… |
CVE-2016-6035 | Medium | 5.4 | 2017-05-10 | IBM Rational Quality Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2016-5889 | High | 8.8 | 2017-05-10 | IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions tr… |
CVE-2016-5888 | Medium | 5.4 | 2017-05-10 | IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2016-3032 | Medium | 5.4 | 2017-05-10 | IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering… |
CVE-2016-10371 | Medium | 5.5 | 2017-05-10 | The TIFFWriteDirectoryTagCheckedRational function in tif_dirwrite.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (assertion failure an… |
CVE-2016-9257 | Medium | 6.1 | 2017-05-09 | In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the… |
CVE-2016-9256 | High | 7.5 | 2017-05-09 | In F5 BIG-IP 12.1.0 through 12.1.2, permissions enforced by iControl can lag behind the actual permissions assigned to a user if the role_map is not reloaded b… |
CVE-2016-9253 | High | 7.5 | 2017-05-09 | In F5 BIG-IP 12.1.0 through 12.1.2, specific websocket traffic patterns may cause a disruption of service for virtual servers configured to use the websocket p… |
CVE-2016-9251 | High | 8.8 | 2017-05-09 | In F5 BIG-IP 12.0.0 through 12.1.2, an authenticated attacker may be able to cause an escalation of privileges through a crafted iControl REST connection. |
CVE-2016-6799 | High | 7.5 | 2017-05-09 | Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i()… |
CVE-2016-8209 | High | 7.5 | 2017-05-08 | Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is… |
CVE-2016-8202 | High | 8.8 | 2017-05-08 | A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allo… |
CVE-2016-10369 | High | 7.8 | 2017-05-08 | unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch… |
CVE-2016-6877 | Medium | 5.3 | 2017-05-05 | Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a c… |
CVE-2016-9692 | High | 8.6 | 2017-05-05 | IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to External Service Interaction attack, caused by improper validation of user-supplied input… |
CVE-2016-9691 | High | 8.6 | 2017-05-05 | IBM WebSphere Cast Iron Solution 7.0.0 and 7.5.0.0 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing… |
CVE-2016-8916 | Medium | 5.5 | 2017-05-05 | IBM Tivoli Storage Manager 5.5, 6.1-6.4, and 7.1 stores password information in a log file that could be read by a local user when a set password command is is… |
CVE-2016-0255 | Medium | 6.1 | 2017-05-05 | IBM Marketing Platform 9.1 and 10.0 is vulnerable to stored cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could… |
CVE-2016-7055 | Medium | 5.9 | 2017-05-04 | There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that handles input leng… |
CVE-2016-7054 | High | 7.5 | 2017-05-04 | In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can… |
CVE-2016-7053 | High | 7.5 | 2017-05-04 | In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling… |
CVE-2016-9976 | High | 8.4 | 2017-05-03 | IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL re… |
CVE-2016-2930 | High | 7.5 | 2017-05-03 | IBM BigFix Remote Control 9.1.3 could allow a remote attacker to perform actions reserved for an administrator without authentication. IBM X-Force ID: 5512. |
CVE-2016-0382 | Medium | 4.0 | 2017-05-03 | The IBM Tealeaf Consumer Experience 8.7, 8.8, and 9.0 portal exposes some of its operational state in a form that may be accidentally captured and exposed by n… |
CVE-2016-10368 | Medium | 6.1 | 2017-05-03 | Open redirect vulnerability in Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016… |
CVE-2016-10367 | High | 7.5 | 2017-05-03 | In Opsview Monitor Pro (Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch), an unauthen… |
CVE-2016-5810 | Medium | 4.9 | 2017-05-02 | upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified ve… |
CVE-2016-5063 | Medium | 5.3 | 2017-05-02 | The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks an… |
CVE-2016-5006 | Critical | 9.8 | 2017-05-02 | The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential inf… |
CVE-2016-4467 | Medium | 5.9 | 2017-05-02 | The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a d… |
CVE-2016-4442 | Medium | 5.3 | 2017-05-02 | The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and objects by leveraging inc… |
CVE-2016-10243 | Critical | 9.8 | 2017-05-02 | TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file. |
CVE-2016-8649 | Critical | 9.1 | 2017-05-01 | lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descriptor, of the host's /… |
CVE-2016-10351 | Medium | 5.5 | 2017-05-01 | Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication information via standard… |
CVE-2016-10350 | Medium | 5.5 | 2017-05-01 | The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a denial of service… |
CVE-2016-10349 | Medium | 5.5 | 2017-05-01 | The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer over-read and appl… |
CVE-2016-8593 | High | 8.8 | 2017-04-28 | Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute a… |
CVE-2016-8592 | High | 8.8 | 2017-04-28 | log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root u… |
CVE-2016-8591 | High | 8.8 | 2017-04-28 | log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via… |
CVE-2016-8590 | High | 8.8 | 2017-04-28 | log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user… |
CVE-2016-8589 | High | 8.8 | 2017-04-28 | log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user… |
CVE-2016-8588 | High | 7.3 | 2017-04-28 | The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell me… |
CVE-2016-8587 | High | 7.3 | 2017-04-28 | dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archi… |
CVE-2016-8586 | High | 8.8 | 2017-04-28 | detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as th… |
CVE-2016-8585 | High | 8.8 | 2017-04-28 | admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root use… |
CVE-2016-8584 | Critical | 9.8 | 2017-04-28 | Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier uses predictable session values, which allows remote attackers to bypass authentication by guessi… |
CVE-2016-7843 | Medium | 5.5 | 2017-04-28 | Directory traversal vulnerability in AttacheCase for Java 0.60 and earlier, AttacheCase Lite 1.4.6 and earlier, and AttacheCase Pro 1.5.7 and earlier allows re… |
CVE-2016-7842 | Medium | 5.5 | 2017-04-28 | Directory traversal vulnerability in AttacheCase 2.8.2.8 and earlier and 3.2.0.4 and earlier allows remote attackers to read arbitrary files via specially craf… |
CVE-2016-7841 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter. |
CVE-2016-7840 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in WEB SCHEDULE allows remote attackers to inject arbitrary web script or HTML via the month parameter. |
CVE-2016-7839 | Medium | 6.1 | 2017-04-28 | Cross-site scripting vulnerability in Olive Blog allows remote attackers to inject arbitrary web script or HTML via the search parameter. |
CVE-2016-7815 | Medium | 4.2 | 2017-04-28 | Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the network. |
CVE-2016-8962 | Medium | 5.9 | 2017-04-26 | IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts… |
CVE-2016-8924 | Medium | 5.6 | 2017-04-26 | IBM Maximo Asset Management 7.1, 7.5 and 7.6 could allow a remote attacker to hijack a user's session, caused by the failure to invalidate an existing session… |
CVE-2016-8030 | Medium | 4.3 | 2017-04-25 | A memory corruption vulnerability in Scriptscan COM Object in McAfee VirusScan Enterprise 8.8 Patch 8 and earlier allows remote attackers to create a Denial of… |
CVE-2016-6915 | High | 7.8 | 2017-04-24 | Stack-based buffer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Table TK1… |
CVE-2016-6917 | High | 7.8 | 2017-04-24 | Buffer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Table TK1 before OTA… |
CVE-2016-6916 | High | 7.8 | 2017-04-24 | Integer overflow in nvhost_job.c in the NVIDIA video driver for Android, Shield TV before OTA 3.3, Shield Table before OTA 4.4, and Shield Table TK1 before OTA… |
CVE-2016-6903 | Critical | 9.9 | 2017-04-24 | lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands. |
CVE-2016-6902 | Critical | 9.9 | 2017-04-24 | lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands. |
CVE-2016-5551 | Low | 2.8 | 2017-04-24 | Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: NAS device addition). The supported version that is affected… |
CVE-2016-5016 | Medium | 5.9 | 2017-04-24 | Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud… |
CVE-2016-4313 | High | 7.8 | 2017-04-24 | Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archi… |
CVE-2016-3691 | High | 8.8 | 2017-04-24 | Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method. |